docs: add code of conduct

CODE_OF_CONDUCT.md

@@ -0,0 +1,31 @@
+# Code of Conduct
+
+yedir-ai contributors, maintainers, users, and reviewers are expected to keep collaboration respectful, professional, and focused on improving the project.
+
+## Expected Behavior
+
+- Be respectful and constructive in issues, pull requests, reviews, and discussions.
+- Assume good intent, but ask for clarification when something is unclear.
+- Give actionable feedback with context and concrete examples.
+- Respect privacy and confidentiality. Do not post secrets, private user data, private prompts, signed URLs, screenshots with credentials, or sensitive business information.
+- Keep disagreements technical and evidence-based.
+
+## Unacceptable Behavior
+
+- Harassment, intimidation, discrimination, personal attacks, or abusive language.
+- Publishing private information without explicit permission.
+- Posting real credentials, tokens, cookies, OAuth codes, Authorization headers, signed URLs, or private user content.
+- Deliberately disrupting discussions, reviews, CI, or project operations.
+- Ignoring maintainer requests to move security-sensitive details to a private channel.
+
+## Security-Sensitive Reports
+
+Do not report vulnerabilities in public issues. Follow `SECURITY.md` and contact the project maintainer privately.
+
+## Enforcement
+
+Maintainers may edit or remove comments, close issues, block users, or restrict participation when behavior violates this code of conduct. Enforcement should be proportional, documented when appropriate, and focused on protecting contributors and users.
+
+## Scope
+
+This code applies to project spaces including GitHub issues, pull requests, discussions, documentation, community chat, and any other collaboration channel used for yedir-ai.

CONTRIBUTING.md

@@ -63,3 +63,7 @@ For frontend changes, include screenshots or a short visual verification note. F
 ## Security
 
 Follow `SECURITY.md` for vulnerability reporting and sensitive-data handling. Report suspected vulnerabilities privately; do not open public issues for secrets, auth bypasses, signed URL leaks, or data exposure.
+
+## Conduct
+
+Follow `CODE_OF_CONDUCT.md` in issues, pull requests, reviews, and community spaces.

README.md

@@ -113,6 +113,7 @@ tests/                       Playwright e2e and route-level tests
 - [发布就绪检查清单](docs/release-readiness.md)
 - [安全策略](SECURITY.md)
 - [贡献指南](CONTRIBUTING.md)
+- [行为准则](CODE_OF_CONDUCT.md)
 
 ## 开发边界